crowdsecurity/crowdsec · error

authorization header does not start with 'Bearer '

Error message

authorization header does not start with 'Bearer '

What it means

For a bearer-token security scheme, the single Authorization header must start with the exact prefix 'Bearer ' (capital B, one space). A present, singular header with any other value fails validation.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:244

					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Basic ") {
					return errors.New("authorization header does not start with 'Basic '")
				}
				authTokenValue = values[0][6:]
			case "bearer":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")
				}
				authTokenValue = values[0][7:]
			}
		case "apiKey":
			switch input.SecurityScheme.In {
			case "query":
				//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator
				values := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]
				if len(values) == 0 {
					return fmt.Errorf("query parameter %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple query parameters with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]

View on GitHub (pinned to 909b515798)

Solutions

1. Set the header to 'Authorization: Bearer <token>' with capital B and a single space
2. If basic credentials are what you have, change the security scheme to scheme=basic
3. Normalize the scheme prefix in client code before sending (strings.ToUpper + explicit space)
4. Verify the token itself is valid — if the prefix is right but the token is garbage, you'll hit a downstream 401 instead

Example fix

// before
req.Header.Set("Authorization", token)
// after
req.Header.Set("Authorization", "Bearer "+token)

v := req.Header.Get("Authorization"); if !strings.HasPrefix(v, "Bearer ") { return fmt.Errorf("expected 'Bearer ' prefix, got %q", v) }

if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), "does not start with 'Bearer '") { /* fix token prefix in client */ } }

When it happens

Trigger: Exactly one Authorization header whose value does not start with "Bearer " (e.g. 'Basic ...', 'bearer tok' lowercase, or a raw token with no scheme) while the scheme is bearer.

Common situations: Client switched from basic to bearer auth but still sends basic credentials; hand-rolled token code omitting the 'Bearer ' prefix; lowercase scheme from non-standard clients; token pasted without prefix.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• authorization header not found
• multiple Authorization headers found
• authorization header does not start with 'Basic '
• auth token is required but not provided
• missing scenarios list in login request for TLS auth: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5923af776d63308e. Report an issue: GitHub.